IP blocked then allowed

[ridzuan.a]

Hi, 
I'm reviewing a logs regarding a low reputation IP which in the first log it's action is dropped, and 5 minutes later 3 logs with action allowed. Why does it dropped then allowed it?

Logs

category: spyware

action: dropped

Threat Name: CobaltStrike.Gen Command and Control Traffic
Threat ID: 18005

[ridzuan.a]

I'm new to the forum, thanks in advance

[OtakarKlier]

Hello,

Not sure if its the case here however logs are typically written at 'session end'. We would need to see redacted logs to try and figure this out. Just black out the source and destination IP's along with anything that could identify your company etc.

Regards,

[ridzuan.a]

Hi, please find the ss below

[OtakarKlier]

Hello,

So the 'later' traffic is UDP (DNS-Base) so it has to 'time out' since there is no fin packets. This is the most likely reason for the later timestamp in the logs. The policy is most likely set to log at session end, which is best practice.

Hope this helps.

[ridzuan.a]

does UDP has fin packets?

[ridzuan.a]

i did a bit of research from your explanation, using the first link below to understand the session end. then using data from Session End reason: threat, i found out the answer in the second link. thanks for your help

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/use-syslog-for-monitoring/sysl...
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO

[OtakarKlier]

Hello,

Glad you found what you needed.

Cheers!